{"cve":"CVE-2023-2801","nvd":{"published":"2023-06-06T19:15:11.413","modified":"2026-06-17T05:53:28.457","status":"Modified","description":"Grafana is an open-source platform for monitoring and observability. \n\nUsing public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.\n\nThe only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.\n\nThis might enable malicious users to crash Grafana instances through that endpoint.\n\nUsers may upgrade to version 9.4.12 and 9.5.3 to receive a fix.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.3},"cwes":["CWE-662","CWE-820"],"references":["https://grafana.com/security/security-advisories/cve-2023-2801/","https://security.netapp.com/advisory/ntap-20230706-0002/","https://grafana.com/security/security-advisories/cve-2023-2801/","https://security.netapp.com/advisory/ntap-20230706-0002/"],"products":["grafana:grafana"],"source":"nvd","synced_at":"2026-10-19T21:38:24.161619714+00:00"},"epss":{"cve":"CVE-2023-2801","score":0.00745,"percentile":0.54797,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-x2w4-c67p-g44j","url":"https://osv.dev/vulnerability/GHSA-x2w4-c67p-g44j","summary":"Grafana Missing Synchronization vulnerability","modified":"2026-08-07T08:12:18.702911181Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["<9.4.12"],"fixed":["9.4.12"]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=9.5.0 <9.5.3"],"fixed":["9.5.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}